1. Field of the Invention
The present invention relates to a method, apparatus, and computer program in a storage medium for analyzing ongoing service processes executed by a plurality of servers in a network system. More particularly, the present invention relates to a service process analyzing method, apparatus, and program for analyzing message traffic to identify service transactions taking place on a network system.
2. Description of the Related Art
Many of the systems providing Internet banking and other services are so large and complicated that it is extremely difficult to keep track of their processing activities or to locate the cause of failure or performance degradation. Those service processing systems are often organized as a network of multiple servers. A typical method to supervise the operating status of such a system is to collect operation log records at each server and analyze the collected records individually. Another method is to evaluate the service processing times measured by sending a request from a client and receiving a response from the destination server.
However, the former approach may overlook problems in such a case where the individual servers appear to be operating properly even though they do have a difficulty in server-to-server communications. The latter method also has a shortcoming in that it only watches client interface, ignoring interaction between servers.
Yet another method is proposed to analyze the behavior of a network system, including communication between servers. See, for example, “IBM Tivoli Monitoring for Transaction Performance helps maximize performance of your applications,” International Business Machines Corporation, 2003. The proposed method analyzes messages exchanged between servers, based on the knowledge about massages used in actual transactions. This technique, however, cannot work in the cases where unknown applications are running on a server, or where the transactions have unknown layer structures.
Still another method is to discover every pair of server request and response by analyzing collected packets. See, for example, “LonManager Protocol Analyzer User's Guide Revision 1.0,” Echelon Corporation, 1994. The proposed method analyzes the number of acknowledgment messages, response times, and the like for each individual processing request. However, this approach offers no solutions for analyzing a transaction as a series of processes invoked by a single service request.
Japanese Patent Application No. 2004-185909 proposes a solution for the above-described shortcomings of conventional methods. According to this patent application, a transaction model is built from message log records, based on the certainty of call dependency between messages. Even with this improved method, however, it is still difficult to build a correct model for infrequent transactions. Suppose, for example, that a message log contains the following records:                980 transactions of “HTTP;A-RDB2;p”        20 transactions of “HTTP;A-RDB2;p-RDB2;q”where “HTTP;A-RDB2;p” means a combination of a message of HTTP process “A” and a message of RDB2 process “p,” and “HTTP;A-RDB2;p-RDB2;q” means a combination of a message of HTTP process “A” and two messages of RDB2 processes “p” and “q.” Here the message “HTTP;A” is a calling message that initiates some server processes, causing more messages in the course of processing. In the present example, the method described in the Japanese Patent Application No. 2004-185909 will give a certainty of 98% to the former group of transactions “HTTP;A-RDB2;p” and 2% to the latter group of transactions “HTTP;A-RDB2;p-RDB2;q” with respect to the calling message “HTTP;A.” With a certainty threshold greater than 2%, the method would neglect the minority transactions “HTTP;A-RDB2;p-RDB2;q.” This could be a pitfall in analyzing recent web service systems which tend to produce a very wide variety of transactions from a single calling message.        